CycloneDX / CycloneDX/cyclonedx-rust-cargo
Output is target specific but does not go in target directory
- Dominant language
- Rust
- Stars
- 178
- Forks
- 66
- PR merge metrics
- No merged PRs in 30d
Description
CycloneDX picks up target-specific dependencies (as it should).
So, I need to run it for each of the multiple targets my project supports. However, by default it puts the output from the different runs in the same file.
Build output goes in a `target//release` directory, so maybe the SBOM should go there too.
There does not seem to be an option to specify the output directory, which would allow me to direct the output to a target specific directory.
`--override-filename` does not allow a directory path to be included, which might have been a different solution.
I tried changing to the desired output directory and using `--manifest-path` to find Cargo.toml, but the output was produced in the same directory as `--manifest-path`, not in the directory in which the tool was run.
I can specify `--target-in-filename` to provide disambiguation, so this is not a blocking issue.
Contributor guide
Research direction
Start by tracing the CLI handling for --manifest-path, --override-filename, and --target-in-filename, then compare its output location with Cargo's target//release directory. Check whether existing tests cover multiple target runs or output paths. Done means each target's SBOM can be directed to, or is placed in, a target-specific directory without breaking current filename options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- build-system, cli
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100